--- title: GitHub Actions workflow lockfiles in public preview description: GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Lockfiles... canonical: https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub Actions workflow lockfiles in public preview | daily.dev og:description: GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Lockfiles... og:url: https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky og:image: https://api.daily.dev/og/posts/3zOiK06ky.png og:image:alt: GitHub Actions workflow lockfiles in public preview og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Actions workflow lockfiles in public preview **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 0 comments ## Summary GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Lockfiles pin workflow dependencies to reviewed commits so that a moved tag or branch cannot silently change what code runs, protecting against compromised actions. The gh actions-lock CLI extension generates a .github/workflows/actions.lock file covering actions, their transitive dependencies, and reusable workflow dependencies; onboarding is gradual per workflow. A new Require lockfile policy lets enterprise, organization, or repository admins mandate lockfile use. Dependabot now regenerates matching lockfile entries automatically when it opens version update PRs for onboarded workflows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are GitHub Actions workflow lockfiles and what problem do they solve? Workflow lockfiles pin GitHub Actions dependencies to specific reviewed commits so that a moved tag or branch cannot silently introduce different code into a workflow run. They are generated with the gh actions-lock CLI extension into .github/workflows/actions.lock, covering actions, transitive dependencies, and reusable workflow dependencies, and are now in public preview for GitHub Enterprise Cloud. _daily.dev surfaces supply-chain security updates like this for teams hardening their CI/CD pipelines._ ### How do I create a GitHub Actions lockfile and enforce its use? Install the gh actions-lock extension for the GitHub CLI from the gh-actions-lock repository, generate the lockfile, then review and commit it alongside workflow changes. Onboarding happens per workflow, and once onboarded, GitHub Actions requires every dependency to have a lockfile entry and runs only the recorded commit. Admins can also enable the Require lockfile policy at the enterprise, organization, or repository level. _Teams rolling out Actions lockfiles can track setup guidance and policy changes via daily.dev._ ### Does Dependabot work with GitHub Actions workflow lockfiles? Yes, when Dependabot opens a version update pull request for an action in an already onboarded workflow, it automatically regenerates the matching lockfile entry in the same pull request, keeping the updated reference and its locked commit in sync without extra configuration. _Developers automating dependency updates can follow Dependabot and Actions integration news on daily.dev._ ## Similar posts on daily.dev - [GitHub agentic workflows and Renovate](https://daily.dev/posts/github-agentic-workflows-and-renovate-ds5b5qufx) · A Java geek · 59 upvotes · 4 comments - [GitHub Separates Who Writes Code From Who Runs Your CI](https://daily.dev/posts/github-separates-who-writes-code-from-who-runs-your-ci-nku4hdcup) · DevOps.com · 0 upvotes · 0 comments - [What’s coming to our GitHub Actions 2026 security roadmap](https://daily.dev/posts/what-s-coming-to-our-github-actions-2026-security-roadmap-i3m40rpi3) · GitHub Blog · 0 upvotes · 0 comments - [GitHub Agentic Workflows is now in public preview](https://daily.dev/posts/github-agentic-workflows-is-now-in-public-preview-0sx9s8ezu) · GitHub Changelog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#dependabot](https://daily.dev/tags/dependabot) [View this post on daily.dev](https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub Actions workflow lockfiles in public preview","url":"https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky"},"datePublished":"2026-10-14T14:03:48.574Z","dateModified":"2026-10-14T14:04:13.000Z","description":"GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Lockfiles...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59930dd82904346ecafe98d1ae91b3ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59930dd82904346ecafe98d1ae91b3ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,cicd,github-actions,dependabot","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"GitHub Actions workflow lockfiles in public preview"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github-actions-workflow-lockfiles-in-public-preview-3zoik06ky#faq","mainEntity":[{"@type":"Question","name":"What are GitHub Actions workflow lockfiles and what problem do they solve?","acceptedAnswer":{"@type":"Answer","text":"Workflow lockfiles pin GitHub Actions dependencies to specific reviewed commits so that a moved tag or branch cannot silently introduce different code into a workflow run. They are generated with the gh actions-lock CLI extension into .github/workflows/actions.lock, covering actions, transitive dependencies, and reusable workflow dependencies, and are now in public preview for GitHub Enterprise Cloud. daily.dev surfaces supply-chain security updates like this for teams hardening their CI/CD pipelines."}},{"@type":"Question","name":"How do I create a GitHub Actions lockfile and enforce its use?","acceptedAnswer":{"@type":"Answer","text":"Install the gh actions-lock extension for the GitHub CLI from the gh-actions-lock repository, generate the lockfile, then review and commit it alongside workflow changes. Onboarding happens per workflow, and once onboarded, GitHub Actions requires every dependency to have a lockfile entry and runs only the recorded commit. Admins can also enable the Require lockfile policy at the enterprise, organization, or repository level. Teams rolling out Actions lockfiles can track setup guidance and policy changes via daily.dev."}},{"@type":"Question","name":"Does Dependabot work with GitHub Actions workflow lockfiles?","acceptedAnswer":{"@type":"Answer","text":"Yes, when Dependabot opens a version update pull request for an action in an already onboarded workflow, it automatically regenerates the matching lockfile entry in the same pull request, keeping the updated reference and its locked commit in sync without extra configuration. Developers automating dependency updates can follow Dependabot and Actions integration news on daily.dev."}}]} ```